mandiant / mandiant/capa-rules
persist via Run registry key
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
match(set registry value) hits for a call that occurs XX calls before the persistence key is opened. The match(set registry value) that we want to hit is the next call after match(create or open registry key).
We may be able to mitigate this by adding call order matching to dynamic, e.g., we expect the hit order to be match(create or open registry key), match(set registry value).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior described by the VirusTotal trigger and inspect the dynamic matching behavior for registry operations. Determine how the create/open registry key and set registry value matches are currently ordered; done means the intended persistence behavior is matched without the earlier false hit, with coverage for the chosen matching behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100